1202186 - Hide password in calls of console.log() and console.error()

Status: RESOLVED FIXED

(DevTools :: General, defect)

Description

[Dragana Damjanovic [:dragana]]

Calls of console.log(...) and console.error(...) will show password in uri. It should be hidden.

Bug 1197791 will add GetAnonymousSpec() function to nsIURI to hide the password. It can use this function

Comment 1

[:Gijs (he/him)]

Does this still need to happen? AFAICT this has been fixed at the core level?

Comment 2

[Dragana Damjanovic [:dragana]]

If you mean that bug 197791 has fix this. No, it did not fix this problem. console.log() and console.error() do not use nsScriptError. I have open this bug because I do not know this code to decide where is the right place to fix it. The fix is easy if you know the right place.

Comment 3

[Panos Astithas (he/him) [:past] (please ni?)]

I don't have access to bug 1197791 to see what the fix looks like, but presumably you'd want to make the same changes to Console.cpp.

Comment 4

[:Gijs (he/him)]

Attachment: MozReview Request: Bug 1202186 - use nsISensitiveInfoHidden for console methods, r?past

Bug 1202186 - use nsISensitiveInfoHidden for console methods, r?past

Comment 5

[:Gijs (he/him)]

To be clear, I don't know the code here well enough to be sure this is comprehensive enough, but it seemed to work in my very very very limited testing. I also don't know if/which tests are likely to break because of this change.

Comment 6

[Panos Astithas (he/him) [:past] (please ni?)]

Comment on attachment 8660890 [details]
MozReview Request: Bug 1202186 - use nsISensitiveInfoHidden for console methods, r?past

baku knows this code better than me.

Comment 7

[Andrea Marchesini [:baku]]

Comment on attachment 8660890 [details]
MozReview Request: Bug 1202186 - use nsISensitiveInfoHidden for console methods, r?past

https://reviewboard.mozilla.org/r/19213/#review17159

lgtm!

::: dom/base/Console.cpp:39
(Diff revision 1)
> +#include "nsISensitiveInfoHiddenURI.h"

alphabetic order. Move it to line 38.

::: dom/base/Console.cpp:1224
(Diff revision 1)
> +      event.mFilename.Assign(NS_ConvertUTF8toUTF16(spec));

CopyUTF8toUTF16(spec, event.mFilename);

Comment 8

[:Gijs (he/him)]

remote:   https://treeherder.mozilla.org/#/jobs?repo=try&revision=1ac871b9e94d

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/fx-team/rev/4aa1e0f5013b

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/4aa1e0f5013b